{"id":16271,"date":"2022-09-29T09:57:43","date_gmt":"2022-09-29T09:57:43","guid":{"rendered":"https:\/\/www.pieravukatlik.com\/?p=16271"},"modified":"2023-06-12T12:12:22","modified_gmt":"2023-06-12T12:12:22","slug":"cerez-karari","status":"publish","type":"post","link":"https:\/\/www.pieravukatlik.com\/en\/yayinlarimiz\/guncel-yazilarimiz\/kvkk\/cerez-karari\/","title":{"rendered":"Brief on Personal Data Protection Authority\u2019s Decision Dated 10.03.2022 Regarding Cookies Used in Website\/Mobile Applications"},"content":{"rendered":"<div id=\"toc_container\" class=\"no_bullets\"><p class=\"toc_title\">\u0130&ccedil;indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#Internet_Sitesinde_Kullanilan_Cerezlerin_Aydinlatma_Yukumlulugu_ve_Yurtdisina_Aktarimina_Dair_Sikayet\">Complaint On the Obligation to Inform and Transfer of Data Abroad Regarding the Cookies Used On the Website<\/a><\/li><li><a href=\"#Kurul8217un_Cerez_Kullanimina_Dair_Degerlendirmeleri\">The Board's Evaluations On Usage of Cookies<\/a><\/li><li><a href=\"#Sonuc\">Conclusion<\/a><\/li><\/ul><\/div>\n\n<p class=\"has-medium-font-size translation-block\">Data processing activities are encountered in new and various fields every day. The Personal Data Protection Board (\u201c<strong>Board<\/strong>\u201c) puts these areas under strict scrutiny within the scope of the Personal Data Protection Law No. 6698 (\u201c<strong>KVKK<\/strong>\u201c). Even minor practices encountered in online environments which can be overlooked are of significance for the Board in order to establish compliance to personal data law. In online environments, cookies are at the top of the issues concerning personal data law.<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">Within the framework of the Board\u2019 decision dated 10.03.2022 and numbered 2022\/229, the terms of use of online cookies and the transfer of information obtained through these cookies have been evaluated within the scope of KVKK. You can reach the concerned decision <a href=\"https:\/\/www.kvkk.gov.tr\/Icerik\/7275\/2022-229\" data-type=\"URL\" data-id=\"https:\/\/www.kvkk.gov.tr\/Icerik\/7275\/2022-229\" target=\"_blank\" rel=\"noreferrer noopener\">here <\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span id=\"Internet_Sitesinde_Kullanilan_Cerezlerin_Aydinlatma_Yukumlulugu_ve_Yurtdisina_Aktarimina_Dair_Sikayet\">Complaint On the Obligation to Inform and Transfer of Data Abroad Regarding the Cookies Used On the Website<\/span><\/h2>\n\n\n\n<p class=\"has-medium-font-size translation-block\">It was stated in the complaint submitted to the Board that; (<strong>i<\/strong>) the obligation to inform regarding the use of cookies is not fulfilled, (<strong>ii<\/strong>) no explicit consent has been obtained for the use of cookies besides this information have been transferred abroad, (<strong>iii<\/strong>) the cookie policy presented on the concerned website does not reflect the truth, and (<strong>iv<\/strong>) the data processed by using analytical cookies on the website are transferred abroad illegally.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p class=\"has-medium-font-size\">In their defense, the data controller:<\/p>\n\n\n\n<ul class=\"has-medium-font-size\">\n<li class=\" translation-block\">accepted that the data of the subject is not in the status of \"strictly necessary cookies\", which is necessary for the operation of the website and mandatory for the fulfillment of the service requested by users, but within the scope of the requirement that they should be processed for their legitimate interests,<\/li>\n\n\n\n<li class=\" translation-block\">cookies that are not <em>\u201cstrictly necessary cookies\u201d<\/em> are also necessary for the data controller company<\/li>\n\n\n\n<li>cookies are not presented as a prerequisite for the service provided,<\/li>\n\n\n\n<li>negotiations started with companies that offer technical solutions for obtaining explicit consent for the use of cookies,<\/li>\n\n\n\n<li>the use of cookies will improve the customer experience, otherwise it will deeply harm company\u2019s own activities, will push the company out of competition and therefore  there is no doubt that the company has a legitimate interest in the use of cookies and<\/li>\n\n\n\n<li class=\" translation-block\"><em>\"tracking wall\"<\/em> applications which prevent a visitor from accessing the content of the website unless they approve the use of all cookies are not in practice and the use of the website continues effectively if cookies are disabled stated in their defense.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span id=\"Kurul8217un_Cerez_Kullanimina_Dair_Degerlendirmeleri\">The Board's Evaluations On Usage of Cookies<\/span><\/h2>\n\n\n\n<p class=\"has-medium-font-size translation-block\">Considering this information, the Board ruled that; in the case that they do not meet one of the conditions stipulated in the KVKK, the use of cookies other than \"strictly necessary cookies\" is subject to the explicit consent of the data subject. In light of the evaluations made, although the data controller claimed they had \"legitimate interest\", which is one of the conditions provided in the law, it is stated that it is not possible to rely on this condition in terms of the processing activity carried out and the explicit consent of the data subject should be acquired.<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><\/p>\n\n\n\n<p class=\"has-medium-font-size\">At the same time, it has been understood that there are advertising\/promotional cookies in the cookie policy on the website of the data controller, and that third-party cookies are used for advertising and retargeting, therefore, personal data has been processed by the data controller via the advertising\/marketing cookies. Nevertheless, it has been established that visitors of the data controller's website have only been informed with a pop-up, but their explicit consent have not been acquired.<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">Also, it has been observed that instructions that are provided within the cookie policy regarding how to turn off the notifications and cookies. However, in the case that no condition for processing personal data exists (other than explicit consent) with respect to functional cookies, performance-analytical cookies and advertising\/marketing cookies, which are out of the scope of \"strictly necessary cookies\" (which ensure the proper operation of the website); it is subject to the voluntary active action of the visitors at the entry to the website.<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><\/p>\n\n\n\n<p class=\"has-medium-font-size\">Regarding data transfer, it has been determined that the transfer of personal data abroad can only be carried out based on explicit consent, and in this context, the operations carried out by the data controller by transferring personal data abroad through cookies are not in accordance with the law.<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">In light of the inspections, it was stated that information is provided regarding cookies in the Privacy and Personal Data Protection Policy of the data controller, however it should be updated to include a link which will direct the data subject to the cookie policy. It has been underlined that the data controller also created a Cookie Policy apart from the Privacy and Personal Data Protection Policy and the information that the data controller presented about cookies in the Privacy Policy should also be included in the Cookie Policy. In addition, it was emphasized that the policy in question should comply with the Communiqu\u00e9 on the Procedures and Principles to be Complied with in Fulfilling the Obligation to Inform (\u201c<strong>Communiqu\u00e9<\/strong>\u201d).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span id=\"Sonuc\">Conclusion<\/span><\/h2>\n\n\n\n<p class=\"has-medium-font-size\">In this context, evaluating the Cookie Policy it has been observed that;<\/p>\n\n\n\n<ul class=\"has-medium-font-size\">\n<li class=\" translation-block\">no accurate information has been provided regarding the numerous rights that a person has in accordance with Article 4 of the Communiqu\u00e9 and Article 11 of the KVKK and<\/li>\n\n\n\n<li>there is no detailed information with respect to which data processing activity coincides with which processing purpose and it is seen that the table displaying the purposes of each type of cookie is not clear enough to be understood by the data subject and consequently, it has been determined that the relevant policy is incomplete in terms of Article 5 of the Communiqu\u00e9.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">In the light of all the evaluations, it was decided to impose an administrative fine of <strong>800,000 TRY<\/strong> on the data controller and to make the necessary  arrangements in line with the evaluations made above.<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><\/p>\n\n\n\n<p class=\"has-medium-font-size\">Minor and overlooked issues such as cookie practices in online activities should be modified to be in compliance with the obligations of the KVKK. One of the most remarkable aspect of this decision is the Board\u2019s evaluations regarding the processing of personal data without explicit consent and the transfer of this data abroad. When the decision is examined, it is clear that these issues are a point of emphasis for the Board and with this decision an important deficiency in the jurisprudence has been completed with a detailed evaluation. Consequently, this has become another aspect of KVKK compliance which companies should pay attention to in their websites or mobile applications.<\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">You can <a href=\"https:\/\/www.pieravukatlik.com\/iletisim\/\" data-type=\"URL\" data-id=\"https:\/\/www.pieravukatlik.com\/iletisim\/\" target=\"_blank\" rel=\"noreferrer noopener\">reach<\/a> our \u0130zmir Personal Data Lawyers to get expert legal support on the protection of your personal data or your company's personal data law compliance.<\/p>","protected":false},"excerpt":{"rendered":"<p>\u0130&ccedil;indekiler\u0130nternet Sitesinde Kullan\u0131lan \u00c7erezlerin Ayd\u0131nlatma Y\u00fck\u00fcml\u00fcl\u00fc\u011f\u00fc ve Yurtd\u0131\u015f\u0131na Aktar\u0131m\u0131na Dair \u015eikayetKurul&#8217;un \u00c7erez Kullan\u0131m\u0131na Dair De\u011ferlendirmeleriSonu\u00e7 G\u00fcn\u00fcm\u00fczde veri i\u015fleme faaliyetleriyle yeni ve \u00e7e\u015fitli alanlarda kar\u015f\u0131la\u015fmak m\u00fcmk\u00fcnd\u00fcr. Ki\u015fisel Verileri Koruma Kurulu (\u201cKurul\u201d), 6698 say\u0131l\u0131 Ki\u015fisel Verilerin Korunmas\u0131 Kanunu (&#8220;KVKK&#8220;) kapsam\u0131nda bu alanlar\u0131 da s\u0131k\u0131 bir inceleme alt\u0131na&#8230;<\/p>","protected":false},"author":2,"featured_media":16274,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[66],"tags":[65],"_links":{"self":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts\/16271"}],"collection":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/comments?post=16271"}],"version-history":[{"count":8,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts\/16271\/revisions"}],"predecessor-version":[{"id":17066,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts\/16271\/revisions\/17066"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/media\/16274"}],"wp:attachment":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/media?parent=16271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/categories?post=16271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/tags?post=16271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}